Data protection information

Privacy Policy

Last updated: 9 November 2026

This Privacy Policy explains how personal information is handled when you visit the Melqoravianessa website, ask about a jewellery commission or repair, or communicate with the workshop. It is intended to explain the purposes, lawful bases, retention approach and rights that apply under the UK GDPR and the Data Protection Act 2018.

1. Who is responsible for your information

The data controller identified for this website is Melqoravianessa Jewellery Ltd (“Melqoravianessa”, “we”, “us” or “our”). The business contact address is 38 Gillygate, York, North Yorkshire, YO31 7EQ, United Kingdom. You can contact us using the details shown on the Contact page.

The controller is responsible for deciding why and how personal information is used. Where another organisation processes information on the controller’s behalf, that organisation must act under appropriate instructions and safeguards.

2. Personal information we may handle

The information depends on the way you communicate with us and the work requested. It may include:

• identity and contact details, such as your name, email address, telephone number and correspondence address;
• enquiry details, including the type of jewellery, the service requested, preferred design, measurements, budget range and relevant dates;
• commission and repair records, such as approved drawings, item descriptions, metal marks, stone details, estimates, instructions, collection records and aftercare notes;
• transaction and accounting information required to record payments, invoices, deposits, refunds and tax obligations;
• communications you choose to provide, including photographs of jewellery, reference images and messages about the work.

Please avoid sending information that is not relevant to your enquiry. We do not intentionally request special-category personal data for ordinary jewellery services.

3. How information is obtained

Information may be provided directly when you contact the workshop, request an estimate, discuss a commission, arrange a repair or collect an item. Some information is created during the service, for example an assessment note, an approved specification or a record of work completed. Basic technical information may also be generated by the web hosting environment when a page is requested, such as server logs used for security and fault diagnosis.

4. Purposes and lawful bases

We use personal information only where a lawful basis applies. Depending on the circumstances, the relevant purposes and bases may include:

• Responding to enquiries and preparing estimates: taking steps at your request before entering into a contract, under Article 6(1)(b) UK GDPR.
• Providing commissions, repairs and aftercare: performing a contract and managing the instructions you have approved, under Article 6(1)(b).
• Keeping invoices and financial records: complying with legal obligations, including applicable accounting and tax requirements, under Article 6(1)(c).
• Maintaining workshop records and protecting property: pursuing legitimate interests in documenting agreed work, resolving queries, preventing misuse and establishing or defending legal claims, under Article 6(1)(f). We consider the impact on individuals and use only information reasonably needed for those purposes.
• Optional marketing or non-essential device storage: relying on consent where the law requires it. Consent can be withdrawn at any time.

We do not use personal information to make decisions about you solely by automated means that produce legal or similarly significant effects.

5. Sharing information

Information is shared only when necessary for the purposes described in this Policy. Depending on the service, recipients may include staff or authorised workshop personnel, payment and accounting providers, insurers, couriers or delivery services, professional advisers, IT and hosting providers, and public authorities where disclosure is required by law. We do not sell personal information.

Where a service provider processes information on our behalf, we require appropriate contractual confidentiality and security commitments. A recipient acting as an independent controller is responsible for its own processing and must provide its own privacy information where required.

6. International transfers

We aim to use service arrangements that keep personal information within the United Kingdom. If a provider or recipient requires a transfer outside the UK, the transfer will be assessed and made only where a valid transfer mechanism and appropriate safeguards are in place, such as UK adequacy regulations or an approved contractual safeguard. Information about the relevant safeguard can be requested using the contact details on this website.

7. How long information is retained

Information is kept only for as long as it is needed for the purpose for which it was collected, taking account of legal, accounting and dispute-resolution requirements. Enquiry records that do not lead to work are normally reviewed for deletion after 12 months. Commission and repair records may be kept for the duration of the customer relationship and for a reasonable period afterwards to answer questions about the work. Financial and tax records are retained for the period required by applicable law, which may be up to six years after the relevant accounting period. Records needed for a legal claim may be retained until that matter is resolved and the relevant limitation period has expired.

When information is no longer required, it is securely deleted or anonymised. Retention periods may be extended where a legal obligation or a specific dispute requires it.

8. Security

Appropriate technical and organisational measures are used to protect personal information against unauthorised access, accidental loss, alteration or disclosure. Access is limited to people who need the information for their work. No method of electronic transmission or storage can be guaranteed to be completely secure, but suspected incidents are assessed and handled in accordance with applicable data protection requirements.

9. Your data protection rights

Subject to the conditions and exemptions in data protection law, you may have the right to:

• receive clear information about how your personal information is used;
• request access to personal information and receive a copy;
• ask for inaccurate or incomplete information to be corrected;
• request erasure of information where the legal conditions are met;
• request restriction of processing in specified circumstances;
• object to processing based on legitimate interests or to direct marketing;
• receive certain information in a portable format where the right applies;
• withdraw consent where processing is based on consent. Withdrawal does not affect processing carried out lawfully before withdrawal.

To exercise a right, contact us and describe the request. We may need to verify your identity before responding. We normally respond within one month, although the law permits an extension in certain complex cases. Some rights are subject to exemptions, and we will explain the outcome if a request cannot be fully met.

10. Complaints

If you are concerned about how your personal information has been handled, contact us first so that we can investigate. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

11. Children

This website and the workshop services are intended for general customers and are not designed to collect children’s personal information. A parent or guardian should contact us if they believe a child has provided personal information without appropriate authorisation.

12. Changes to this Policy

We may update this Policy when our services, information practices or legal obligations change. The latest revision date appears at the top of this page. Material changes will be reflected in the wording published here.